I believe this is expected behavior. You might want to chase down wdrewry@, bartfab@, and others in enterprise / security to understand what the intended model was. I do know bartfab@ has made the case in other contexts that this is necessary to rectify network issues that may hamper regular user login.